القائمة
Use when a task needs FLOSS through the local `runFloss` or `flossHelp` MCP tools, especially when forming a valid FLOSS command string, choosing flags, or handling quoted paths.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when a task needs Mandiant capa through the local `runCapa` or `capaHelp` MCP tools, especially when forming a valid capa command string, choosing output mode, or avoiding path-quoting mistakes.
Use when a task needs the local YARA MCP tools `yaraScan`, `yaraScanInline`, `yaraWriteRule`, `yaraListRules`, or `yaraHelp`, including choosing whether to scan with a saved rule file, inline rule text, or persist a rule into the standardized generated-artifact YARA directory.
Use when writing, reviewing, or explaining YARA rule syntax, or when preparing `rule_text` for `yaraScanInline` or `yaraWriteRule` so the rule can be saved into the standardized generated-artifact YARA directory.
Use when a task should persist reusable helper files such as Python deobfuscation scripts, Java helpers, reports, or Ghidra-supporting snippets into the standardized agent artifact directory tree.
Use when the task requires emitting a patched binary copy through the local MCP tool lane, especially for short instruction patches or explicit byte replacements.
Use when a task would benefit from a secondary model call through the local MCP tool lane, especially for Hugging Face or OpenAI-compatible inference, decompilation cleanup, classification, or comparing competing interpretations.
| name | floss-mcp |
| description | Use when a task needs FLOSS through the local `runFloss` or `flossHelp` MCP tools, especially when forming a valid FLOSS command string, choosing flags, or handling quoted paths. |
Use this skill when working with the local runFloss(...) wrapper.
flossHelp() before building a new command string.-- before the target path.runFloss(command, timeout_sec=300)flossHelp(timeout_sec=5)argv[0] must be floss or floss.exe.runFloss(
command='floss --json -- "C:\\Samples\\example.exe"'
)
flossHelp() when you are unsure about flags.